Skip to content

Virement bancaire: communication structurée [fr]

5 juin 2011
By Askarel in fr

rev="post-347" 1 Comment

Voici un petit bout de script qui génère une communication structurée valable pour un virement bancaire en Belgique. L’avantage de ce système est que la banque n’exécutera pas le virement si il y a une erreur lors de la retranscription des chiffres.

# Generate the 'Communication' field for the virement
# Format: +++DDD/DDDD/DDDSS+++
# DDDDDDDDDD: Any number you like.
# SS: Above number mod 97. Set to 97 if zero.
# Banks love obsolete^Wproven technologies. :-)
mkcomm ()
{
# In case of collision, the function can take a salt as an optional parameter.
COMMSTR="$1$RANDOM$RANDOM$RANDOM$RANDOM$RANDOM"
COMMSTR="${COMMSTR:0:10}" # Trim string length to 10
COMM_MODULO=$(expr $COMMSTR % 97 ) # Get reminder
case $COMM_MODULO in # Padding and/or correction
"0") COMM_MODULO="97" ;;
[1-9]) COMM_MODULO="0$COMM_MODULO" ;;
esac
#echo "$COMMSTR$COMM_MODULO" #Debug
echo "+++${COMMSTR:0:3}/${COMMSTR:3:4}/${COMMSTR:7:3}$COMM_MODULO+++" # Chop into blocks
}

Si votre banque vous autorise à télécharger vos extraits de comptes au format .csv (possible chez Dexia et Argenta), il suffit simplement de faire une recherche sur la chaîne de caractères de la communication structurée pour trouver la trace du paiement.

Tags: , , , , ,

EPIC FAIL [en]

12 mai 2011
By Askarel in en, fr

rev="post-339" 1 Comment

Ce matin, à vélo, sur le chemin du travail (et pas loin de l’arrivée en plus).

This morning, on the bicycle, on the way to work (and very close to my destination).

Tags: , , ,

Opening the Vasco Digipass 810 [en]

24 février 2011
By Askarel in en

rev="post-290" 23 Comments

Vasco Digipass 810

Vasco Digipass 810

Many belgian and european banks are providing their customers with a device that look like a small calculator. This device, coupled with your bank card,  is used to secure and authenticate the transactions when using internet banking.

Since that device is fairly standard, there is nothing stopping you from using the reader from bank A with your card from bank Z and vice versa, because the crypto processing is happening on the chip of your card.

Knowing that the heavy crypto work is delegated to the bank card, it is safe to assume that the device is quite dumb: a keypad to feed data to the card, a screen to display the results and a micro-controller to do some simple housekeeping tasks, like update the screen, poll the keypad, clock the card and send/receive data.

I have no proof of what’s described above, but since mine had dead batteries after five years of use, it has become a prime candidate for exploration, so let’s open the case !! 🙂

Ugh !!

Digipass cracked open

Opened !!

It was a tough nut to crack !!

There are no screws and no clips holding it closed: the two halves of the case are welded together !! This is another prime example of planned obsolescence and wasteful engineering. There is no way to open it cleanly, you need to break it apart as careful as possible to get access to the main PCB and the batteries. Your ability to close the box afterward will fully depend on how you open it in the first place.

The batteries are nothing exotic: just two CR-2032 button cells. They are wired in series on the PCB, because many smartcards require a 5V power supply to work properly.

Circuit board detail

All test pads are clearly labelled !

When you observe the PCB, there are a lot of interesting test points, all properly labeled. A hacker’s dream. 🙂

Fried !!

Unfortunately, while groping at it with a multimeter set to continuity tester, i fried the microcontroller. Apparently, that kind of invasive measurement was enough to kill it.

I wanted to check the continuity between the SDATA test pad and the DATA line on the card connector, the SCLK and the CLOCK line of the card connector. There was no continuity between those points and the J2 pad is still a mystery of what the purpose could be. An optional eeprom maybe ?

I received a new reader to continue with my day to day banking operations, but i still want to see the data flowing between the card and the reader. My mistake is just a setback: i will change strategy and try to (ab)use the reader as-is, without opening the case. 🙂

More to come later. In the meantime, here are the Manufacturer’s information

 

Tags: , , ,

Acer Aspire One review: two years later [en]

27 juin 2010
By Askarel in en

rev="post-27" No Comments

Two years ago i bought my first netbook: here are my impressions

Acer Aspire One

The good

  • The laptop is very light and pleasant to carry around
  • It came with Linpus Linux pre-installed. This mean i didn’t have to pay the Microsoft tax. Since i’m running Debian on it, that install was quickly ditched.
  • There is a gap between the screen and the main chassis, allowing me to hold it open and straight with one hand. There was a note in the user manual that this is NOT the way to hold it (risk of crushed fingers) This is really a killer feature for a road warrior that should be more developped.

The bad

  • small screen, low resolution. This cause a problem with many applications where some dialog boxes « sink » under the bottom of the screen.
  • battery life: i have about two hours of usable battery life: this can be tight sometimes
  • Lack of 3G modem: That was not an issue during the first five months because i didn’t have a subscription at the time. Now i have one and i’m stuck with that huge USB modem hanging from the USB port. A small extension cord and some velcro adhesive partially solved the bulky adapter problem. I’m now trying to find 90° angled male USB A connector to keep the size under control.
  • No bluetooth. Not really an issue because there are USB adapters on the market that stick out by less than 5 mm. Less opportunities to cause damage.
  • Limited CPU ressources: The machine has a hard time to keep up with heavy applications like playing a flash video or running the compiler. You just need to be very patient on that.

The ugly

  • After eight months of use, the right touchpad button was not working anymore.
  • It failed totally ten months after purchase: when turned on, the fan and harddisk were spinning, but the screen stayed black (no backlight) and there was no activity. This was fixed under warranty. However, i had to fight to get it fixed: the first time i got it back, the problem was still there. And the reseller told me that they changed the motherboard. It then went back for repair and it was fixed one month later. In total, i have been without for two months
  • To access the harddisk, you have to COMPLETELY DISMANTLE the laptop. That was a real PITA.

Conclusion

Despite it’s flaws, this machine has become my main workhorse when i’m away from home and saved my butt a few times already. After two years of daily carrying and nearly daily use, there are no cracks in the shell. My previous laptops failed by the case, with cracks at very nasty places after about two years of moderate use and carrying. I don’t plan to retire it at the moment: i tend to keep my machines until they are horribly obsolete or simply fall apart. Let’s see in about two years then. 🙂

Tags: , , ,

A kind of antitheft software [fr]

18 janvier 2010
By Askarel in en

rev="post-116" No Comments

Okay, i never ever got my laptop stolen, but reading this will just make you smile.

Many laptops and netbooks comes with a built-in low to mid-resolution webcam on top of the screen, normally to be used for video chatting. If you’re running Linux and you’re slightly paranoid, you maybe would like to see that piece of hardware put to some other use. 🙂

This script is monitoring the lid/screen switch of your laptop. Once someone open the screen, the script activate the camera, take a few pictures and send them back to you to an external e-mail address. Unlike the software used in the article linked above, this one is completely invisible, independent and works even when not logged in or without X running.

Notes:

  • You must have a local SMTP server on the laptop: this server will handle the e-mail queue and retry sending to the external SMTP server if the network is unreliable. The script will consider his job done once the mail is gone to the local server. Setting up the mail servers will be part of another article someday.
  • There is a config file to set up in /etc/antitheftd.conf. There is only one variable that MUST be set: DEST_EMAIL with your destination e-mail address. You can set other variables, but the default settings are nice enough.

« It doesn’t get much better than their bringing us a picture of the guy actually using the stolen property, It certainly made our job easier. » Daniel Jackson, deputy commissioner of public safety, city of White Plains.

The code is here. Have fun !!

Tags: , , , , , ,